Date: Mon, 21 Apr 2025 21:15:44 GMT From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 8b9d1dc82ac4 - stable/14 - pf: don't use state keys after pf_state_insert() Message-ID: <202504212115.53LLFi8S033328@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/14 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=8b9d1dc82ac420ee1c1f524861affef59c4d5ba7 commit 8b9d1dc82ac420ee1c1f524861affef59c4d5ba7 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2025-03-27 14:35:40 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2025-04-21 20:25:45 +0000 pf: don't use state keys after pf_state_insert() pf_state_insert() may free the state keys, it's not safe to access these pointers after the call. Introduce osrc/odst (similar to osport/odport) to store the original source and destination addresses. This allows us to undo NAT transformations without having to access the state keys. Reviewed by: glebius, markj MFC after: 3 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D49551 (cherry picked from commit bdea9cbcf2decafeb4da5a0280313efccc09e1b3) --- sys/net/pfvar.h | 6 ++++-- sys/netpfil/pf/pf.c | 12 ++++++++---- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 949cb36ee474..2f7e4b913c91 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -1557,8 +1557,10 @@ struct pf_pdesc { struct pf_krule *nat_rule; /* nat/rdr rule applied to packet */ struct pf_addr *src; /* src address */ struct pf_addr *dst; /* dst address */ - u_int16_t *sport; - u_int16_t *dport; + struct pf_addr osrc; + struct pf_addr odst; + u_int16_t *sport; + u_int16_t *dport; struct pf_mtag *pf_mtag; struct pf_rule_actions act; diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index c962821b8acd..c74d2f5efadb 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -3472,8 +3472,8 @@ pf_return(struct pf_krule *r, struct pf_krule *nr, struct pf_pdesc *pd, /* undo NAT changes, if they have taken place */ if (nr != NULL) { - PF_ACPY(saddr, &sk->addr[pd->sidx], af); - PF_ACPY(daddr, &sk->addr[pd->didx], af); + PF_ACPY(saddr, &pd->osrc, pd->af); + PF_ACPY(daddr, &pd->odst, pd->af); if (pd->sport) *pd->sport = sk->port[pd->sidx]; if (pd->dport) @@ -5305,8 +5305,8 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a, struct pf_state_key *skt = s->key[PF_SK_WIRE]; if (pd->dir == PF_OUT) skt = s->key[PF_SK_STACK]; - PF_ACPY(pd->src, &skt->addr[pd->sidx], pd->af); - PF_ACPY(pd->dst, &skt->addr[pd->didx], pd->af); + PF_ACPY(pd->src, &pd->osrc, pd->af); + PF_ACPY(pd->dst, &pd->odst, pd->af); if (pd->sport) *pd->sport = skt->port[pd->sidx]; if (pd->dport) @@ -8501,6 +8501,8 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, pd.src = (struct pf_addr *)&h->ip_src; pd.dst = (struct pf_addr *)&h->ip_dst; + PF_ACPY(&pd.osrc, pd.src, pd.af); + PF_ACPY(&pd.odst, pd.dst, pd.af); pd.ip_sum = &h->ip_sum; pd.proto = h->ip_p; pd.tos = h->ip_tos & ~IPTOS_ECN_MASK; @@ -9052,6 +9054,8 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb pd.src = (struct pf_addr *)&h->ip6_src; pd.dst = (struct pf_addr *)&h->ip6_dst; + PF_ACPY(&pd.osrc, pd.src, pd.af); + PF_ACPY(&pd.odst, pd.dst, pd.af); pd.tos = IPV6_DSCP(h); pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202504212115.53LLFi8S033328>